models

Documentation

Index

• type Event
• type Indicator
• type KernelEvent
  • func GetKernelEventContext(e Event) *KernelEvent
• type ProcessEvent
  • func GetProcessEventContext(e Event) *ProcessEvent

Types

type Event

type Event struct {
	Event      *api.TelemetryEvent
	Indicators []Indicator
	ClientAddr string
}

Event contains information about the source, the original event, and any indicators gathered up to the point in time

type Indicator

type Indicator struct {
	ID             string `orm:"column(id);index;pk"`
	ProcessID      string `orm:"column(process_id);index"`
	ProcessEventID string `orm:"column(process_event_id);index"`
	Engine         string
	RuleName       string `orm:"column(rule_name)"`
	IndicatorType  string `orm:"column(indicator_type)"`
	Description    string
	ExtraInfo      string `orm:"column(extra_info)"`
	Score          int
}

Indicator is an individual result from an engine

type KernelEvent

type KernelEvent struct {
	ID            string    `orm:"column(id);index;pk"`
	CreatedAt     time.Time `orm:"column(created_at);auto_now_add;type(datetime)"`
	SensorID      string    `orm:"column(sensor_id);index"`
	ProcessID     string    `orm:"column(process_id);index"`
	ContainerID   string    `orm:"column(container_id)"`
	ContainerName string    `orm:"column(container_name)"`
	ProcessPID    int32     `orm:"column(process_pid);index"`
	Credentials   string    `orm:"column(credentials)"`

	Dest string `orm:"column(dest);index"`
}

KernelEvent is that

func GetKernelEventContext

func GetKernelEventContext(e Event) *KernelEvent

GetKernelEventContext returns a KernelEvent from an Event returns nil if it is not a KernelEvent

type ProcessEvent

type ProcessEvent struct {
	ID            string    `orm:"column(id);index;pk" json:"id"`
	CreatedAt     time.Time `orm:"column(created_at);auto_now_add;type(datetime)"`
	SensorID      string    `orm:"column(sensor_id);index"`
	ProcessID     string    `orm:"column(process_id);index"`
	ContainerID   string    `orm:"column(container_id)"`
	ContainerName string    `orm:"column(container_name)"`
	ProcessPID    int32     `orm:"column(process_pid);index"`
	Credentials   string    `orm:"column(credentials)"`

	ProcessEventType string `orm:"column(process_event_type)"`
	ExecFilename     string `orm:"column(exec_filename)"`
	ExecCmdLine      string `orm:"column(exec_cmd_line)"`
	ForkChildPID     int32  `orm:"column(fork_child_pid);index"`
	ForkChildID      string `orm:"column(fork_child_id)"`
}

ProcessEvent is that

func GetProcessEventContext

func GetProcessEventContext(e Event) *ProcessEvent

GetProcessEventContext returns a ProcessEvent from an Event returns nil if it is not a ProcessEvent